Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    72s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/03/2023, 18:56

General

  • Target

    b858057f8b6bdda8598fa1c04fd537d73f402bd06a7bb3559b2c49c8198a0446.exe

  • Size

    658KB

  • MD5

    2b41383e82245967013a0aa7a20c10c9

  • SHA1

    f8b6c766616a9c2e547cac8972fd425f528fdf46

  • SHA256

    b858057f8b6bdda8598fa1c04fd537d73f402bd06a7bb3559b2c49c8198a0446

  • SHA512

    c5691ee9657b5ef3e7043a393b69d1549d6c7cde0afa32d6548e6d00a226c2fa88f718500d27aa48ce34fcdfda5db69ef62fa6c2202c31c1e62d4549744879a7

  • SSDEEP

    12288:rMrYy90eOluVMGvDHZ6rv9Nnfg81JINfeg5RJIqP5gq2Hx6tAwM:fyBO0VMegRfyV5f5soM

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Extracted

Family

redline

Botnet

foksa

C2

hueref.eu:4162

Attributes
  • auth_value

    6a9b2601a21672b285de3ed41b5402e4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 22 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b858057f8b6bdda8598fa1c04fd537d73f402bd06a7bb3559b2c49c8198a0446.exe
    "C:\Users\Admin\AppData\Local\Temp\b858057f8b6bdda8598fa1c04fd537d73f402bd06a7bb3559b2c49c8198a0446.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycaR53IP12.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycaR53IP12.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urri86xi96.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urri86xi96.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:996
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrib65HE10.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrib65HE10.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4316
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuRy39zg96.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuRy39zg96.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4032

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuRy39zg96.exe

    Filesize

    175KB

    MD5

    75ced8ad0d8cd237ebc9cb7b00852651

    SHA1

    adab63df3e0a40fd9f170ab57da66f01f226141c

    SHA256

    a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

    SHA512

    f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xuRy39zg96.exe

    Filesize

    175KB

    MD5

    75ced8ad0d8cd237ebc9cb7b00852651

    SHA1

    adab63df3e0a40fd9f170ab57da66f01f226141c

    SHA256

    a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

    SHA512

    f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycaR53IP12.exe

    Filesize

    513KB

    MD5

    55feb4a464a21228169d5e08da534eec

    SHA1

    32394b22d361d39ecd13d6288045d31ae368c9cf

    SHA256

    79835e1183963c5f05b813b3678ac46e5d3ac21f4855024bdd6ac96638bdd040

    SHA512

    dd959c47284b5468f1113ec888a4fcb539ee5ca0a2420f6528d4785c39a0ed26f7061b7d44e55c53564c59c254c55469c783b73936e886d9f737a0ecc57cf2dd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycaR53IP12.exe

    Filesize

    513KB

    MD5

    55feb4a464a21228169d5e08da534eec

    SHA1

    32394b22d361d39ecd13d6288045d31ae368c9cf

    SHA256

    79835e1183963c5f05b813b3678ac46e5d3ac21f4855024bdd6ac96638bdd040

    SHA512

    dd959c47284b5468f1113ec888a4fcb539ee5ca0a2420f6528d4785c39a0ed26f7061b7d44e55c53564c59c254c55469c783b73936e886d9f737a0ecc57cf2dd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urri86xi96.exe

    Filesize

    231KB

    MD5

    22b881080c5443070fcb5bf47fd14536

    SHA1

    9a81a5c111385c1d3bde3e017a553c55b9e8f376

    SHA256

    77d200f4afd1696760e4a0fd4f7ff8fbe2023789bbfb424b45a9805e50e3ea25

    SHA512

    7dfa621e59c40f5535f8cbd4ad453873b73b6e070baa0148abfc7063e9b2bc56a2773abc3a58642f50d8bdcb35c6ead0e0505fd49fe7733e05763396d88bc0c3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urri86xi96.exe

    Filesize

    231KB

    MD5

    22b881080c5443070fcb5bf47fd14536

    SHA1

    9a81a5c111385c1d3bde3e017a553c55b9e8f376

    SHA256

    77d200f4afd1696760e4a0fd4f7ff8fbe2023789bbfb424b45a9805e50e3ea25

    SHA512

    7dfa621e59c40f5535f8cbd4ad453873b73b6e070baa0148abfc7063e9b2bc56a2773abc3a58642f50d8bdcb35c6ead0e0505fd49fe7733e05763396d88bc0c3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrib65HE10.exe

    Filesize

    289KB

    MD5

    f719d70ebe5b666b482c91b61516218e

    SHA1

    61da23978f14b2ef38e7d14113172346145fe6ba

    SHA256

    439904dbd91520dd5e82eb107d025d3f0e7a74e30f1e1743976c046d5b28e568

    SHA512

    be894aa89bf97710e2eeb77425880a452abffebdc742c3426222aa433d558636398b36df659d6cea3eae614a1a5fc624da514f17074bcf8034039ddb1a12ee72

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrib65HE10.exe

    Filesize

    289KB

    MD5

    f719d70ebe5b666b482c91b61516218e

    SHA1

    61da23978f14b2ef38e7d14113172346145fe6ba

    SHA256

    439904dbd91520dd5e82eb107d025d3f0e7a74e30f1e1743976c046d5b28e568

    SHA512

    be894aa89bf97710e2eeb77425880a452abffebdc742c3426222aa433d558636398b36df659d6cea3eae614a1a5fc624da514f17074bcf8034039ddb1a12ee72

  • memory/996-146-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-156-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-136-0x0000000004CA0000-0x000000000519E000-memory.dmp

    Filesize

    5.0MB

  • memory/996-137-0x00000000024B0000-0x00000000024C8000-memory.dmp

    Filesize

    96KB

  • memory/996-138-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/996-139-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/996-140-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/996-141-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-142-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-144-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-134-0x0000000000670000-0x000000000069D000-memory.dmp

    Filesize

    180KB

  • memory/996-148-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-150-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-152-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-154-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-135-0x00000000021B0000-0x00000000021CA000-memory.dmp

    Filesize

    104KB

  • memory/996-158-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-160-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-162-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-164-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-166-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-168-0x00000000024B0000-0x00000000024C2000-memory.dmp

    Filesize

    72KB

  • memory/996-169-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/996-170-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/996-171-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/996-172-0x0000000004C90000-0x0000000004CA0000-memory.dmp

    Filesize

    64KB

  • memory/996-174-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/4032-1113-0x0000000000FF0000-0x0000000001022000-memory.dmp

    Filesize

    200KB

  • memory/4032-1116-0x00000000033F0000-0x0000000003400000-memory.dmp

    Filesize

    64KB

  • memory/4032-1115-0x00000000033F0000-0x0000000003400000-memory.dmp

    Filesize

    64KB

  • memory/4032-1114-0x0000000005920000-0x000000000596B000-memory.dmp

    Filesize

    300KB

  • memory/4316-181-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-439-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-186-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-188-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-190-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-192-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-194-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-196-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-198-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-200-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-202-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-204-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-206-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-208-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-210-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-212-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-214-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-435-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-433-0x0000000000590000-0x00000000005DB000-memory.dmp

    Filesize

    300KB

  • memory/4316-184-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-437-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-1091-0x0000000005770000-0x0000000005D76000-memory.dmp

    Filesize

    6.0MB

  • memory/4316-1092-0x0000000005160000-0x000000000526A000-memory.dmp

    Filesize

    1.0MB

  • memory/4316-1093-0x0000000005270000-0x0000000005282000-memory.dmp

    Filesize

    72KB

  • memory/4316-1094-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/4316-1095-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-1096-0x00000000053D0000-0x000000000541B000-memory.dmp

    Filesize

    300KB

  • memory/4316-1098-0x0000000005570000-0x0000000005602000-memory.dmp

    Filesize

    584KB

  • memory/4316-1099-0x0000000005610000-0x0000000005676000-memory.dmp

    Filesize

    408KB

  • memory/4316-1100-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-1101-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-1102-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-1103-0x0000000006570000-0x0000000006732000-memory.dmp

    Filesize

    1.8MB

  • memory/4316-1104-0x0000000004C50000-0x0000000004C60000-memory.dmp

    Filesize

    64KB

  • memory/4316-182-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4316-180-0x0000000004B10000-0x0000000004B54000-memory.dmp

    Filesize

    272KB

  • memory/4316-179-0x0000000002370000-0x00000000023B6000-memory.dmp

    Filesize

    280KB

  • memory/4316-1105-0x0000000006740000-0x0000000006C6C000-memory.dmp

    Filesize

    5.2MB

  • memory/4316-1106-0x0000000006F00000-0x0000000006F76000-memory.dmp

    Filesize

    472KB

  • memory/4316-1107-0x0000000006F80000-0x0000000006FD0000-memory.dmp

    Filesize

    320KB